jstedfast/MailKit · error · NotSupportedException

The SMTP server does not support the STARTTLS extension.

Error message

The SMTP server does not support the STARTTLS extension.

What it means

Thrown in SmtpClient.Connect when SecureSocketOptions.StartTls is explicitly requested but the server's EHLO response does not advertise the STARTTLS capability. MailKit honors the caller's demand for opportunistic TLS and refuses to continue in plaintext rather than silently downgrading.

Solutions

1. Use SecureSocketOptions.SslOnConnect for port 465, and StartTls only for port 587.
2. Use SecureSocketOptions.Auto to let MailKit pick the right strategy from the port/capabilities.
3. After EHLO, check (client.Capabilities & SmtpCapabilities.StartTLS) before demanding StartTls, or accept plaintext if the capability is absent and your security policy allows it.

Example fix

// before
client.Connect("smtp.example.com", 465, SecureSocketOptions.StartTls); // NotSupportedException

// after
client.Connect("smtp.example.com", 465, SecureSocketOptions.SslOnConnect);

client.Connect(host, port, SecureSocketOptions.Auto); // or pick SslOnConnect for 465, StartTls for 587

try {
    client.Connect(host, 587, SecureSocketOptions.StartTls);
} catch (NotSupportedException ex) {
    // server lacks STARTTLS; either fail closed or retry with Auto per security policy
    throw new SmtpTlsPolicyException("STARTTLS unavailable on server", ex);
}

When it happens

Trigger: Connect(host, port, SecureSocketOptions.StartTls) against a server that never offers STARTTLS — typically port 465 (implicit-SSL-only servers), port 25 relays with TLS disabled, or servers whose STARTTLS is hidden by policy.

Common situations: Using StartTls on port 465 (wrong pairing: 465 needs SslOnConnect); old/insecure mail servers without TLS support; firewalls/security appliances stripping the STARTTLS advertisement.

Related errors

• The IMAP server does not support the STARTTLS extension.
• The POP3 server does not support the STLS extension.
• The POP3 server does not support the STLS extension.
• The SMTP server does not support the STARTTLS extension.
• The SMTP server does not support authentication.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/0bd86f4ef814eb26. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Smtp/SmtpClient.cs:1369

				stream.Dispose ();
				secure = false;
				throw;
			}

			Stream = new SmtpStream (stream, ProtocolLogger);

			try {
				// read the greeting
				var response = Stream.ReadResponse (cancellationToken);

				if (response.StatusCode != SmtpStatusCode.ServiceReady)
					throw new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);

				// Send EHLO and get a list of supported extensions
				Ehlo (true, cancellationToken);

				if (options == SecureSocketOptions.StartTls && (capabilities & SmtpCapabilities.StartTLS) == 0)
					throw new NotSupportedException ("The SMTP server does not support the STARTTLS extension.");

				if (starttls && (capabilities & SmtpCapabilities.StartTLS) != 0) {
					response = Stream.SendCommand ("STARTTLS\r\n", cancellationToken);
					if (response.StatusCode != SmtpStatusCode.ServiceReady)
						throw new SmtpCommandException (SmtpErrorCode.UnexpectedStatusCode, response.StatusCode, response.Response);

					try {
						var tls = new ExtendedSslStream (stream, false, ValidateRemoteCertificate);
						Stream.SetStream (tls);

						SslHandshake (tls, host, cancellationToken);
					} catch (Exception ex) {
						throw SslHandshakeException.Create (ref sslValidationInfo, ex, true, "SMTP", host, port, 465, 25, 587);
					}

					secure = true;

					// Send EHLO again and get the new list of supported extensions

View on GitHub (pinned to 9d3859a785)